{ether,ieee80211}_ifdetach() can't be called with serializer being held, since
[dragonfly.git] / sys / dev / netif / sbsh / if_sbsh.c
1 /**
2  * Granch SBNI16 G.SHDSL Modem driver
3  * Written by Denis I. Timofeev, 2002-2003.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  * $FreeBSD: src/sys/dev/sbsh/if_sbsh.c,v 1.3.2.1 2003/04/15 18:15:07 fjoe Exp $
27  * $DragonFly: src/sys/dev/netif/sbsh/if_sbsh.c,v 1.23 2005/12/31 14:08:00 sephe Exp $
28  */
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/sockio.h>
33 #include <sys/mbuf.h>
34 #include <sys/malloc.h>
35 #include <sys/kernel.h>
36 #include <sys/proc.h>
37 #include <sys/socket.h>
38 #include <sys/random.h>
39 #include <sys/serialize.h>
40 #include <sys/thread2.h>
41
42 #include <net/if.h>
43 #include <net/ifq_var.h>
44 #include <net/if_arp.h>
45 #include <net/ethernet.h>
46 #include <net/if_media.h>
47
48 #include <net/bpf.h>
49
50 #include <vm/vm.h>
51 #include <vm/pmap.h>
52 #include <machine/bus.h>
53 #include <machine/resource.h>
54 #include <sys/bus.h>
55 #include <sys/rman.h>
56
57 #include <bus/pci/pcireg.h>
58 #include <bus/pci/pcivar.h>
59
60 #include "if_sbshreg.h"
61
62 /* -------------------------------------------------------------------------- */
63
64 struct sbni16_hw_regs {
65         u_int8_t  CR, CRB, SR, IMR, CTDR, LTDR, CRDR, LRDR;
66 };
67
68 struct hw_descr {
69         u_int32_t  address;
70         u_int32_t  length;
71 };
72
73 struct cx28975_cmdarea {
74         u_int8_t  intr_host;
75         u_int8_t  intr_8051;
76         u_int8_t  map_version;
77
78         u_int8_t  in_dest;
79         u_int8_t  in_opcode;
80         u_int8_t  in_zero;
81         u_int8_t  in_length;
82         u_int8_t  in_csum;
83         u_int8_t  in_data[75];
84         u_int8_t  in_datasum;
85
86         u_int8_t  out_dest;
87         u_int8_t  out_opcode;
88         u_int8_t  out_ack;
89         u_int8_t  out_length;
90         u_int8_t  out_csum;
91         u_int8_t  out_data[75];
92         u_int8_t  out_datasum;
93 };
94
95 #define XQLEN   8
96 #define RQLEN   8
97
98 struct sbsh_softc {
99         struct arpcom   arpcom;         /* ethernet common */
100
101         struct resource *mem_res;
102         struct resource *irq_res;
103         void            *intr_hand;
104
105         void            *mem_base;              /* mapped memory address */
106
107         volatile struct sbni16_hw_regs  *regs;
108         volatile struct hw_descr        *tbd;
109         volatile struct hw_descr        *rbd;
110         volatile struct cx28975_cmdarea *cmdp;
111
112         /* SBNI16 controller statistics */
113         struct sbni16_stats {
114                 u_int32_t  sent_pkts, rcvd_pkts;
115                 u_int32_t  crc_errs, ufl_errs, ofl_errs, attempts, last_time;
116         } in_stats;
117
118         /* transmit and reception queues */
119         struct mbuf     *xq[XQLEN], *rq[RQLEN];
120         unsigned        head_xq, tail_xq, head_rq, tail_rq;
121
122         /* the descriptors mapped onto the first buffers in xq and rq */
123         unsigned        head_tdesc, head_rdesc;
124         u_int8_t        state;
125 };
126
127 struct cx28975_cfg {
128         u_int8_t   *firmw_image;
129         u_int32_t  firmw_len;
130         u_int32_t  lrate: 10;
131         u_int32_t  master: 1;
132         u_int32_t  mod: 2;
133         u_int32_t  crc16: 1;
134         u_int32_t  fill_7e: 1;
135         u_int32_t  inv: 1;
136         u_int32_t  rburst: 1;
137         u_int32_t  wburst: 1;
138         u_int32_t  : 14;
139 };
140
141 /* SHDSL transceiver statistics */
142 struct dsl_stats {
143         u_int8_t        status_1, status_3;
144         u_int8_t        attenuat, nmr, tpbo, rpbo;
145         u_int16_t       losw, segd, crc, sega, losd;
146 };
147
148 enum State { NOT_LOADED, DOWN, ACTIVATION, ACTIVE };
149
150 #define SIOCLOADFIRMW   _IOWR('i', 67, struct ifreq)
151 #define SIOCGETSTATS    _IOWR('i', 68, struct ifreq)
152 #define SIOCCLRSTATS    _IOWR('i', 69, struct ifreq)
153
154 static int      sbsh_probe(device_t);
155 static int      sbsh_attach(device_t);
156 static int      sbsh_detach(device_t);
157 static int      sbsh_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
158 static void     sbsh_shutdown(device_t);
159 static int      sbsh_suspend(device_t);
160 static int      sbsh_resume(device_t);
161 static void     sbsh_watchdog(struct ifnet *);
162
163 static void     sbsh_start(struct ifnet *);
164 static void     sbsh_init(void *);
165 static void     sbsh_stop(struct sbsh_softc *);
166 static void     init_card(struct sbsh_softc *);
167 static void     sbsh_intr(void *);
168 static void     resume_tx(struct sbsh_softc *);
169 static void     start_xmit_frames(struct sbsh_softc *);
170 static void     encap_frame(struct sbsh_softc *, struct mbuf *);
171 static struct mbuf *    repack(struct sbsh_softc *, struct mbuf *);
172 static void     free_sent_buffers(struct sbsh_softc *);
173 static void     alloc_rx_buffers(struct sbsh_softc *);
174 static void     indicate_frames(struct sbsh_softc *);
175 static void     drop_queues(struct sbsh_softc *);
176 static void     activate(struct sbsh_softc *);
177 static void     deactivate(struct sbsh_softc *);
178 static void     cx28975_interrupt(struct sbsh_softc *);
179 static int      start_cx28975(struct sbsh_softc *, struct cx28975_cfg);
180 static int      download_firmware(struct sbsh_softc *, u_int8_t *, u_int32_t);
181 static int      issue_cx28975_cmd(struct sbsh_softc *, u_int8_t,
182                                         u_int8_t *, u_int8_t);
183
184 static device_method_t sbsh_methods[] = {
185         /* Device interface */
186         DEVMETHOD(device_probe,         sbsh_probe),
187         DEVMETHOD(device_attach,        sbsh_attach),
188         DEVMETHOD(device_detach,        sbsh_detach),
189         DEVMETHOD(device_shutdown,      sbsh_shutdown),
190         DEVMETHOD(device_suspend,       sbsh_suspend),
191         DEVMETHOD(device_resume,        sbsh_resume),
192
193         { 0, 0 }
194 };
195
196 static driver_t sbsh_driver = {
197         "sbsh",
198         sbsh_methods,
199         sizeof(struct sbsh_softc)
200 };
201
202 static devclass_t sbsh_devclass;
203
204 DECLARE_DUMMY_MODULE(if_sbsh);
205 DRIVER_MODULE(if_sbsh, pci, sbsh_driver, sbsh_devclass, 0, 0);
206
207 static int
208 sbsh_probe(device_t dev)
209 {
210         if (pci_get_vendor(dev) != SBNI16_VENDOR
211             || pci_get_device(dev) != SBNI16_DEVICE
212             || pci_get_subdevice(dev) != SBNI16_SUBDEV)
213                 return (ENXIO);
214
215         device_set_desc(dev, "Granch SBNI16 G.SHDSL Modem");
216         return (0);
217 }
218
219 static int
220 sbsh_attach(device_t dev)
221 {
222         struct sbsh_softc       *sc;
223         struct ifnet            *ifp;
224         int                     unit, error = 0, rid;
225
226         sc = device_get_softc(dev);
227         unit = device_get_unit(dev);
228
229         rid = PCIR_MAPS + 4;
230         sc->mem_res = bus_alloc_resource(dev, SYS_RES_MEMORY, &rid,
231                                         0, ~0, 4096, RF_ACTIVE);
232
233         if (sc->mem_res == NULL) {
234                 printf ("sbsh%d: couldn't map memory\n", unit);
235                 error = ENXIO;
236                 goto fail;
237         }
238
239         rid = 0;
240         sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
241             RF_SHAREABLE | RF_ACTIVE);
242
243         if (sc->irq_res == NULL) {
244                 printf("sbsh%d: couldn't map interrupt\n", unit);
245                 error = ENXIO;
246                 goto fail;
247         }
248
249         sc->mem_base = rman_get_virtual(sc->mem_res);
250         init_card(sc);
251         /* generate ethernet MAC address */
252         *(u_int32_t *)sc->arpcom.ac_enaddr = htonl(0x00ff0192);
253         read_random_unlimited(sc->arpcom.ac_enaddr + 4, 2);
254
255         ifp = &sc->arpcom.ac_if;
256         ifp->if_softc = sc;
257         if_initname(ifp, "sbsh", unit);
258         ifp->if_mtu = ETHERMTU;
259         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
260         ifp->if_ioctl = sbsh_ioctl;
261         ifp->if_start = sbsh_start;
262         ifp->if_watchdog = sbsh_watchdog;
263         ifp->if_init = sbsh_init;
264         ifp->if_baudrate = 4600000;
265         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
266         ifq_set_ready(&ifp->if_snd);
267
268         ether_ifattach(ifp, sc->arpcom.ac_enaddr, NULL);
269
270         error = bus_setup_intr(dev, sc->irq_res, INTR_NETSAFE,
271                                 sbsh_intr, sc, &sc->intr_hand, 
272                                 ifp->if_serializer);
273         if (error) {
274                 ether_ifdetach(ifp);
275                 printf("sbsh%d: couldn't set up irq\n", unit);
276                 goto fail;
277         }
278
279         return(0);
280
281 fail:
282         sbsh_detach(dev);
283         return (error);
284 }
285
286 static int
287 sbsh_detach(device_t dev)
288 {
289         struct sbsh_softc *sc = device_get_softc(dev);
290         struct ifnet *ifp = &sc->arpcom.ac_if;
291
292         if (device_is_attached(dev)) {
293                 lwkt_serialize_enter(ifp->if_serializer);
294                 sbsh_stop(sc);
295                 bus_teardown_intr(dev, sc->irq_res, sc->intr_hand);
296                 lwkt_serialize_exit(ifp->if_serializer);
297
298                 ether_ifdetach(ifp);
299         }
300
301         if (sc->irq_res)
302                 bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq_res);
303         if (sc->mem_res) {
304                 bus_release_resource(dev, SYS_RES_MEMORY, PCIR_MAPS + 4,
305                                      sc->mem_res);
306         }
307
308         return (0);
309 }
310
311
312 static void
313 sbsh_start(struct ifnet *ifp)
314 {
315         struct sbsh_softc  *sc = ifp->if_softc;
316
317         if (sc->state == ACTIVE)
318                 start_xmit_frames(ifp->if_softc);
319 }
320
321
322 static void
323 sbsh_init(void *xsc)
324 {
325         struct sbsh_softc       *sc = xsc;
326         struct ifnet            *ifp = &sc->arpcom.ac_if;
327         u_int8_t                t;
328
329         if ((ifp->if_flags & IFF_RUNNING) || sc->state == NOT_LOADED) {
330                 return;
331         }
332
333         bzero(&sc->in_stats, sizeof(struct sbni16_stats));
334         sc->head_xq = sc->tail_xq = sc->head_rq = sc->tail_rq = 0;
335         sc->head_tdesc = sc->head_rdesc = 0;
336
337         sc->regs->IMR = EXT;
338         t = 2;
339         issue_cx28975_cmd(sc, _DSL_CLEAR_ERROR_CTRS, &t, 1);
340         if (issue_cx28975_cmd(sc, _DSL_ACTIVATION, &t, 1) == 0) {
341                 sc->state = ACTIVATION;
342
343                 ifp->if_flags |= IFF_RUNNING;
344                 ifp->if_flags &= ~IFF_OACTIVE;
345         }
346 }
347
348
349 static void
350 sbsh_stop(struct sbsh_softc *sc)
351 {
352         u_int8_t  t;
353
354         sc->regs->IMR = EXT;
355
356         t = 0;
357         issue_cx28975_cmd(sc, _DSL_ACTIVATION, &t, 1);
358         if (sc->state == ACTIVE) {
359                 t = 1;
360                 issue_cx28975_cmd(sc, _DSL_FORCE_DEACTIVATE, &t, 1);
361                 /* FIX! activation manager state */
362
363                 /* Is it really must be done here? It calls from intr handler */
364                 deactivate(sc);
365         }
366
367         sc->regs->IMR = 0;
368         sc->state = DOWN;
369 }
370
371
372 static void
373 init_card(struct sbsh_softc *sc)
374 {
375         sc->state = NOT_LOADED;
376         sc->tbd  = (struct hw_descr *) sc->mem_base;
377         sc->rbd  = (struct hw_descr *) ((u_int8_t *)sc->mem_base + 0x400);
378         sc->regs = (struct sbni16_hw_regs *) ((u_int8_t *)sc->mem_base + 0x800);
379         sc->cmdp = (struct cx28975_cmdarea *) ((u_int8_t *)sc->mem_base + 0xc00);
380
381         sc->regs->CR = 0;
382         sc->regs->SR = 0xff;
383         sc->regs->IMR = 0;
384 }
385
386
387 static int
388 sbsh_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
389 {
390         struct sbsh_softc       *sc = ifp->if_softc;
391         struct ifreq            *ifr = (struct ifreq *) data;
392         struct cx28975_cfg      cfg;
393         struct dsl_stats        ds;
394         int                     error = 0;
395         u_int8_t                t;
396
397         switch(cmd) {
398         case SIOCLOADFIRMW:
399                 if ((error = suser_cred(cr, NULL_CRED_OKAY)) != 0)
400                         break;
401                 if (ifp->if_flags & IFF_UP)
402                         error = EBUSY;
403
404                 bcopy((caddr_t)ifr->ifr_data, (caddr_t)&cfg, sizeof cfg);
405                 if (start_cx28975(sc, cfg) == 0) {
406                         static char  *modstr[] = {
407                                 "TCPAM32", "TCPAM16", "TCPAM8", "TCPAM4" };
408                         if_printf(&sc->arpcom.ac_if, "%s, rate %d, %s\n",
409                                 cfg.master ? "master" : "slave",
410                                 cfg.lrate << 3, modstr[cfg.mod]);
411                 } else {
412                         if_printf(&sc->arpcom.ac_if,
413                                 "unable to load firmware\n");
414                         error = EIO;
415                 }
416                 break;
417
418         case  SIOCGETSTATS :
419                 if ((error = suser_cred(cr, NULL_CRED_OKAY)) != 0)
420                         break;
421
422                 t = 0;
423                 if (issue_cx28975_cmd(sc, _DSL_FAR_END_ATTEN, &t, 1))
424                         error = EIO;
425                 ds.attenuat = sc->cmdp->out_data[0];
426
427                 if (issue_cx28975_cmd(sc, _DSL_NOISE_MARGIN, &t, 1))
428                         error = EIO;
429                 ds.nmr = sc->cmdp->out_data[0];
430
431                 if (issue_cx28975_cmd(sc, _DSL_POWER_BACK_OFF_RESULT, &t, 1))
432                         error = EIO;
433                 ds.tpbo = sc->cmdp->out_data[0];
434                 ds.rpbo = sc->cmdp->out_data[1];
435
436                 if (!issue_cx28975_cmd(sc, _DSL_HDSL_PERF_ERR_CTRS, &t, 1)) {
437                         int i;
438                         for (i = 0; i < 10; ++i)
439                                 ((u_int8_t *) &ds.losw)[i] =
440                                         sc->cmdp->out_data[i];
441                 } else
442                         error = EIO;
443
444                 ds.status_1 = ((volatile u_int8_t *)sc->cmdp)[0x3c0];
445                 ds.status_3 = ((volatile u_int8_t *)sc->cmdp)[0x3c2];
446
447                 bcopy(&sc->in_stats, ifr->ifr_data, sizeof(struct sbni16_stats));
448                 bcopy(&ds, (char *)ifr->ifr_data + sizeof(struct sbni16_stats),
449                     sizeof(struct dsl_stats));
450                 break;
451
452         case  SIOCCLRSTATS :
453                 if (!(error = suser_cred(cr, NULL_CRED_OKAY))) {
454                         bzero(&sc->in_stats, sizeof(struct sbni16_stats));
455                         t = 2;
456                         if (issue_cx28975_cmd(sc, _DSL_CLEAR_ERROR_CTRS, &t, 1))
457                                 error = EIO;
458                 }
459                 break;
460         case SIOCSIFFLAGS:
461                 if (ifp->if_flags & IFF_UP) {
462                         if (!(ifp->if_flags & IFF_RUNNING)) {
463                                 if (sc->state == NOT_LOADED) {
464                                         if_printf(ifp, "firmware wasn't loaded\n");
465                                         error = EBUSY;
466                                 } else
467                                         sbsh_init(sc);
468                         }
469                 } else {
470                         if (ifp->if_flags & IFF_RUNNING) {
471                                 sbsh_stop(sc);
472                                 ifp->if_flags &= ~IFF_RUNNING;
473                         }
474                 }
475                 break;
476
477         case SIOCADDMULTI:
478         case SIOCDELMULTI:
479                 error = 0;
480                 break;
481         default:
482                 error = ether_ioctl(ifp, cmd, data);
483                 break;
484         }
485         return (error);
486 }
487
488
489 static void
490 sbsh_shutdown(device_t dev)
491 {
492         struct sbsh_softc       *sc = device_get_softc(dev);
493
494         lwkt_serialize_enter(sc->arpcom.ac_if.if_serializer);
495         sbsh_stop(sc);
496         lwkt_serialize_exit(sc->arpcom.ac_if.if_serializer);
497 }
498
499 static int
500 sbsh_suspend(device_t dev)
501 {
502         struct sbsh_softc *sc = device_get_softc(dev);
503
504         lwkt_serialize_enter(sc->arpcom.ac_if.if_serializer);
505         sbsh_stop(sc);
506         lwkt_serialize_exit(sc->arpcom.ac_if.if_serializer);
507
508         return (0);
509 }
510
511 static int
512 sbsh_resume(device_t dev)
513 {
514         struct sbsh_softc *sc = device_get_softc(dev);
515         struct ifnet *ifp = &sc->arpcom.ac_if;
516
517         if (ifp->if_flags & IFF_UP)
518                 sbsh_init(sc);
519
520         return (0);
521 }
522
523
524 static void
525 sbsh_watchdog(struct ifnet *ifp)
526 {
527         struct sbsh_softc       *sc = ifp->if_softc;
528
529         if_printf(ifp, "transmit timeout\n");
530
531         if (sc->regs->SR & TXS) {
532                 sc->regs->SR = TXS;
533                 if_printf(ifp, "interrupt posted but not delivered\n");
534         }
535         free_sent_buffers(sc);
536 }
537
538 /* -------------------------------------------------------------------------- */
539
540 static void
541 sbsh_intr(void *arg)
542 {
543         struct sbsh_softc  *sc = (struct sbsh_softc *)arg;
544         u_int8_t  status = sc->regs->SR;
545
546         if (status == 0)
547                 return;
548
549         if (status & EXT) {
550                 cx28975_interrupt(sc);
551                 sc->regs->SR = EXT;
552         }
553
554         if (status & UFL) {
555                 resume_tx(sc);
556                 sc->regs->SR = UFL;
557                 ++sc->in_stats.ufl_errs;
558                 ++sc->arpcom.ac_if.if_oerrors;
559         }
560
561         if (status & RXS) {
562                 sc->regs->SR = RXS;
563                 indicate_frames(sc);
564                 alloc_rx_buffers(sc);
565         }
566
567         if (status & TXS) {
568                 sc->regs->SR = TXS;
569                 free_sent_buffers(sc);
570         }
571
572         if (status & CRC) {
573                 ++sc->in_stats.crc_errs;
574                 ++sc->arpcom.ac_if.if_ierrors;
575                 sc->regs->SR = CRC;
576         }
577
578         if (status & OFL) {
579                 ++sc->in_stats.ofl_errs;
580                 ++sc->arpcom.ac_if.if_ierrors;
581                 sc->regs->SR = OFL;
582         }
583 }
584
585 /*
586  * Look for a first descriptor of a next packet, and write it's number
587  * into CTDR. Then enable the transmitter.
588  */
589 static void
590 resume_tx(struct sbsh_softc *sc)
591 {
592         u_int32_t       cur_tbd = sc->regs->CTDR;
593
594         while (cur_tbd != sc->regs->LTDR
595                 && (sc->tbd[cur_tbd++].length & LAST_FRAG) == 0)
596                 ;
597         sc->regs->CTDR = cur_tbd;
598         sc->regs->CR |= TXEN;
599 }
600
601 static void
602 start_xmit_frames(struct sbsh_softc *sc)
603 {
604         struct ifnet    *ifp = &sc->arpcom.ac_if;
605         struct mbuf     *m;
606
607         /*
608          * Check if we have any free descriptor(s) and free space in
609          * our transmit queue.
610          */
611         while (sc->tail_xq != ((sc->head_xq - 1) & (XQLEN - 1))
612             && sc->regs->LTDR != ((sc->head_tdesc - 1) & 0x7f)) {
613
614                 m = ifq_dequeue(&ifp->if_snd, NULL);
615                 if (m == NULL)
616                         break;
617                 if (m->m_pkthdr.len) {
618                         BPF_MTAP(ifp, m);
619                         encap_frame(sc, m);
620                 } else
621                         m_freem(m);
622         }
623
624         if (sc->regs->CTDR != sc->regs->LTDR)
625                 ifp->if_flags |= IFF_OACTIVE;
626         else
627                 ifp->if_flags &= ~IFF_OACTIVE;
628 }
629
630
631 static void
632 encap_frame(struct sbsh_softc *sc, struct mbuf *m_head)
633 {
634         struct mbuf     *m;
635         u_int32_t       cur_tbd;
636         int  done;
637
638 look_for_nonzero:
639         for (m = m_head; !m->m_len; m = m->m_next)
640                 ;
641
642         cur_tbd = sc->regs->LTDR & 0x7f;
643         done = 0;
644         do {
645                 if (m->m_len < 5 || cur_tbd == ((sc->head_tdesc - 1) & 0x7f)) {
646                         if ((m_head = repack(sc, m_head)) != NULL)
647                                 goto look_for_nonzero;
648                         else
649                                 return;
650                 }
651
652                 sc->tbd[cur_tbd].address = vtophys(mtod(m, vm_offset_t));
653                 sc->tbd[cur_tbd].length  = m->m_len;
654
655                 do {
656                         m = m->m_next;
657                 } while (m && !m->m_len);
658
659                 if (!m) {       /* last fragment has been reached */
660                         sc->tbd[cur_tbd].length |= LAST_FRAG;
661                         done = 1;
662                 }
663
664                 ++cur_tbd;
665                 cur_tbd &= 0x7f;
666         } while (!done);
667
668         sc->xq[sc->tail_xq++] = m_head;
669         sc->tail_xq &= (XQLEN - 1);
670
671         sc->regs->LTDR = cur_tbd;
672         ++sc->in_stats.sent_pkts;
673         ++sc->arpcom.ac_if.if_opackets;
674 }
675
676 static struct mbuf *
677 repack(struct sbsh_softc *sc, struct mbuf *m)
678 {
679         struct mbuf  *m_new;
680
681         MGETHDR(m_new, MB_DONTWAIT, MT_DATA);
682         if (!m_new) {
683                 if_printf (&sc->arpcom.ac_if,
684                            "unable to get mbuf.\n");
685                 return (NULL);
686         }
687
688         if (m->m_pkthdr.len > MHLEN) {
689                 MCLGET(m_new, MB_DONTWAIT);
690                 if (!(m_new->m_flags & M_EXT)) {
691                         m_freem(m_new);
692                         if_printf (&sc->arpcom.ac_if,
693                                    "unable to get mbuf cluster.\n");
694                         return (NULL);
695                 }
696         }
697
698         m_copydata(m, 0, m->m_pkthdr.len, mtod(m_new, caddr_t));
699         m_new->m_pkthdr.len = m_new->m_len = m->m_pkthdr.len;
700         m_freem(m);
701         return (m_new);
702 }
703
704 static void
705 free_sent_buffers(struct sbsh_softc *sc)
706 {
707         u_int32_t  cur_tbd;
708
709         cur_tbd = sc->regs->CTDR;
710
711         while (sc->head_tdesc != cur_tbd) {
712                 /*
713                  * Be careful! one element in xq may correspond to
714                  * multiple descriptors.
715                  */
716                 if (sc->tbd[sc->head_tdesc].length & LAST_FRAG) {
717                         m_freem(sc->xq[sc->head_xq++]);
718                         sc->head_xq &= (XQLEN - 1);
719                 }
720
721                 sc->tbd[sc->head_tdesc].length = 0;
722                 sc->head_tdesc = (sc->head_tdesc + 1) & 0x7f;
723         }
724
725         start_xmit_frames(sc);
726 }
727
728 /*
729  * DON'T use free_sent_buffers to drop the queue!
730  */
731 static void
732 alloc_rx_buffers(struct sbsh_softc *sc)
733 {
734         unsigned        cur_rbd = sc->regs->LRDR & 0x7f;
735         struct mbuf     *m;
736
737         while (sc->tail_rq != ((sc->head_rq - 1) & (RQLEN - 1))) {
738                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
739                 if (!m) {
740                         if_printf (&sc->arpcom.ac_if,
741                                    "unable to get mbuf.\n");
742                         return;
743                 }
744
745                 if (SBNI16_MAX_FRAME > MHLEN) {
746                         MCLGET(m, MB_DONTWAIT);
747                         if (!(m->m_flags & M_EXT)) {
748                                 m_freem(m);
749                                 if_printf (&sc->arpcom.ac_if,
750                                            "unable to get mbuf cluster.\n");
751                                 return;
752                         }
753                         m->m_pkthdr.len = m->m_len = MCLBYTES;
754                 }
755
756                 m_adj(m, 2);    /* align ip on longword boundaries */
757
758                 sc->rq[sc->tail_rq++] = m;
759                 sc->tail_rq &= (RQLEN - 1);
760
761                 sc->rbd[cur_rbd].address = vtophys(mtod(m, vm_offset_t));
762                 sc->rbd[cur_rbd].length  = 0;
763                 sc->regs->LRDR = cur_rbd = (cur_rbd + 1) & 0x7f;
764         }
765 }
766
767 static void
768 indicate_frames(struct sbsh_softc *sc)
769 {
770         struct ifnet *ifp = &sc->arpcom.ac_if;
771         unsigned  cur_rbd = sc->regs->CRDR & 0x7f;
772
773         while (sc->head_rdesc != cur_rbd) {
774                 struct mbuf  *m = sc->rq[sc->head_rq++];
775                 sc->head_rq &= (RQLEN - 1);
776
777                 m->m_pkthdr.len = m->m_len =
778                                 sc->rbd[sc->head_rdesc].length & 0x7ff;
779                 m->m_pkthdr.rcvif = ifp;
780
781                 ifp->if_input(ifp, m);
782                 ++sc->in_stats.rcvd_pkts;
783                 ++ifp->if_ipackets;
784
785                 sc->head_rdesc = (sc->head_rdesc + 1) & 0x7f;
786         }
787 }
788
789 static void
790 drop_queues(struct sbsh_softc *sc)
791 {
792         while (sc->head_rq != sc->tail_rq) {
793                 m_freem(sc->rq[sc->head_rq++]);
794                 sc->head_rq &= (RQLEN - 1);
795         }
796
797         while (sc->head_xq != sc->tail_xq) {
798                 m_freem(sc->xq[sc->head_xq++]);
799                 sc->head_xq &= (XQLEN - 1);
800         }
801 }
802
803 /* -------------------------------------------------------------------------- */
804
805 static void
806 activate(struct sbsh_softc *sc)
807 {
808         struct timeval  tv;
809
810         sc->regs->SR   = 0xff;          /* clear it! */
811         sc->regs->CTDR = sc->regs->LTDR = sc->regs->CRDR = sc->regs->LRDR = 0;
812
813         sc->head_tdesc = sc->head_rdesc = 0;
814         alloc_rx_buffers(sc);
815
816         sc->regs->CRB &= ~RXDE;
817         sc->regs->IMR = EXT | RXS | TXS | CRC | OFL | UFL;
818         sc->regs->CR |= TXEN | RXEN;
819
820         sc->state = ACTIVE;
821         ++sc->in_stats.attempts;
822         microtime(&tv);
823         sc->in_stats.last_time = tv.tv_sec;
824         start_xmit_frames(sc);
825 }
826
827 static void
828 deactivate(struct sbsh_softc *sc)
829 {
830         sc->regs->CR &= ~(RXEN | TXEN);
831         sc->regs->CRB |= RXDE;
832         sc->regs->IMR  = EXT;
833         sc->regs->CTDR = sc->regs->LTDR;
834         sc->regs->CRDR = sc->regs->LRDR;
835         sc->state = ACTIVATION;
836
837         drop_queues(sc);
838 }
839
840 /* -------------------------------------------------------------------------- */
841
842 static void
843 cx28975_interrupt(struct sbsh_softc *sc)
844 {
845         volatile struct cx28975_cmdarea  *p = sc->cmdp;
846         u_int8_t  t;
847
848         if (p->intr_host != 0xfe)
849                 return;
850
851         if (p->out_ack & 0x80) {
852                 if (*((volatile u_int8_t *)p + 0x3c7) & 2) {
853                         if (sc->state != ACTIVE
854                             && (*((volatile u_int8_t *)p + 0x3c0) & 0xc0) == 0x40) {
855                                 activate(sc);
856                                 if_printf(&sc->arpcom.ac_if, "connected to peer\n");
857                         } else if (sc->state == ACTIVE
858                                  && (*((volatile u_int8_t *)p + 0x3c0) & 0xc0) != 0x40) {
859                                 deactivate(sc);
860                                 if_printf(&sc->arpcom.ac_if, "carrier lost\n");
861                         }
862                 }
863
864                 p->intr_host = 0;
865                 t = p->intr_host;
866                 p->out_ack = 0;
867         } else {
868                 wakeup(sc);
869
870                 p->intr_host = 0;
871                 t = p->intr_host;
872         }
873 }
874
875 /* -------------------------------------------------------------------------- */
876
877 static int
878 start_cx28975(struct sbsh_softc *sc, struct cx28975_cfg cfg)
879 {
880         static char  thresh[] = { +8, -4, -16, -40 };
881
882         volatile struct cx28975_cmdarea  *p = sc->cmdp;
883         u_int8_t  t, parm[12];
884
885         p->intr_host = 0;
886         t = p->intr_host;
887
888         /* reset chip set */
889         sc->regs->IMR = EXT;
890         sc->regs->CR  = 0;
891         sc->regs->SR  = 0xff;
892         DELAY(2);
893         sc->regs->CR = XRST;
894         if (cfg.crc16)
895                 sc->regs->CR |= CMOD;
896         if (cfg.fill_7e)
897                 sc->regs->CR |= FMOD;
898         if (cfg.inv)
899                 sc->regs->CR |= PMOD;
900
901         sc->regs->CRB |= RODD | RXDE;
902         if (cfg.rburst)
903                 sc->regs->CRB |= RDBE;
904         if (cfg.wburst)
905                 sc->regs->CRB |= WTBE;
906
907         tsleep(sc, 0, "sbsh", 0);
908         if ((p->out_ack & 0x1f) != _ACK_BOOT_WAKE_UP)
909                 return (-1);
910
911         if (download_firmware(sc, cfg.firmw_image, cfg.firmw_len))
912                 return (-1);
913
914         tsleep(sc, 0, "sbsh", 0);
915         if ((p->out_ack & 0x1f) != _ACK_OPER_WAKE_UP)
916                 return (-1);
917
918         t = cfg.master ? 1 : 9;
919         if (issue_cx28975_cmd(sc, _DSL_SYSTEM_ENABLE, &t, 1))
920                 return (-1);
921
922         t = 0x63;
923         if (issue_cx28975_cmd(sc, _DSL_SYSTEM_CONFIG, &t, 1))
924                 return (-1);
925
926         *(u_int16_t *)parm = cfg.lrate >> 3;
927         parm[2] = parm[3] = parm[0];
928         parm[5] = cfg.lrate & 7;
929         parm[4] = parm[7] = 1;
930         parm[6] = 0;
931         if (issue_cx28975_cmd(sc, _DSL_MULTI_RATE_CONFIG, parm, 8))
932                 return (-1);
933
934         parm[0] = 0x02 | (cfg.mod << 4);
935         parm[1] = 0;
936         if (issue_cx28975_cmd(sc, _DSL_TRAINING_MODE, parm, 2))
937                 return (-1);
938
939         bzero(parm, 12);
940         parm[0] = 0x04;         /* pre-activation: G.hs */
941         parm[4] = 0x04;         /* no remote configuration */
942         parm[7] = 0x01;         /* annex A (default) */
943         parm[8] = 0xff;         /* i-bit mask (all bits) */
944         if (issue_cx28975_cmd(sc, _DSL_PREACTIVATION_CFG, parm, 12))
945                 return (-1);
946
947         parm[0] = 0x03;         /* dying gasp time - 3 frames */
948         parm[1] = thresh[cfg.mod];
949         parm[2] = 0xff;         /* attenuation */
950         parm[3] = 0x04;         /* line probe NMR (+2 dB) */
951         parm[4] = 0x00;         /* reserved */
952         parm[5] = 0x00;
953         if (issue_cx28975_cmd(sc, _DSL_THRESHOLDS, parm, 6))
954                 return (-1);
955
956         t = cfg.master ? 0x23 : 0x21;
957         if (issue_cx28975_cmd(sc, _DSL_FR_PCM_CONFIG, &t, 1))
958                 return (-1);
959
960         t = 0x02;
961         if (issue_cx28975_cmd(sc, _DSL_INTR_HOST_MASK, &t, 1))
962                 return (-1);
963
964         sc->state = DOWN;
965         return (0);
966 }
967
968 static int
969 download_firmware(struct sbsh_softc *sc, u_int8_t *img, u_int32_t img_len)
970 {
971         u_int32_t       t;
972         int             i;
973         u_int8_t        cksum = 0;
974
975         for (i = 0; i < img_len; ++i)
976                 cksum += img[i];
977
978         t = img_len;
979         if (issue_cx28975_cmd(sc, _DSL_DOWNLOAD_START, (u_int8_t *) &t, 4))
980                 return (-1);
981
982         for (i = 0; img_len >= 75; i += 75, img_len -= 75) {
983                 if (issue_cx28975_cmd(sc, _DSL_DOWNLOAD_DATA, img + i, 75))
984                         return (-1);
985         }
986
987         if (img_len
988             &&  issue_cx28975_cmd(sc, _DSL_DOWNLOAD_DATA, img + i, img_len))
989                 return (-1);
990
991         t = (cksum ^ 0xff) + 1;
992         if (issue_cx28975_cmd(sc, _DSL_DOWNLOAD_END, (u_int8_t *) &t, 1))
993                 return (-1);
994
995         return (0);
996 }
997
998 static int
999 issue_cx28975_cmd(struct sbsh_softc *sc, u_int8_t cmd,
1000                         u_int8_t *data, u_int8_t size)
1001 {
1002         volatile struct cx28975_cmdarea  *p = sc->cmdp;
1003         u_int8_t  *databuf = p->in_data;
1004         int  i;
1005
1006         u_int8_t  cksum = 0;
1007
1008         p->in_dest      = 0xf0;
1009         p->in_opcode    = cmd;
1010         p->in_zero      = 0;
1011         p->in_length    = --size;
1012         p->in_csum      = 0xf0 ^ cmd ^ size ^ 0xaa;
1013
1014         for (i = 0; i <= size; ++i) {
1015                 cksum ^= *data;
1016                 *databuf++ = *data++;   /* only 1 byte per cycle! */
1017         }
1018
1019         p->in_datasum   = cksum ^ 0xaa;
1020         p->out_ack      = _ACK_NOT_COMPLETE;
1021         p->intr_8051    = 0xfe;
1022
1023         if (tsleep(sc, 0, "sbsh", hz << 3))
1024                 return (-1);
1025
1026         while (p->out_ack == _ACK_NOT_COMPLETE)
1027                 ;                                       /* FIXME ! */
1028
1029         if ((p->out_ack & 0x1f) == _ACK_PASS) {
1030                 p->out_ack = 0;
1031                 return (0);
1032         } else {
1033                 p->out_ack = 0;
1034                 return (-1);
1035         }
1036 }